Course Outline
Burp Suite Professional Within the IT Audit Cycle
- The tool's role across planning, fieldwork, and reporting phases
- Manual verification compared with automated scanning
- Rules of engagement and testing authorization protocols
Workspace Setup, Scoping, and Traffic Capture
- Configuring the proxy, browser, and TLS
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidence preservation
HTTP/HTTPS Traffic Inspection and Application Mapping
- Analyzing request and response structures, headers, and cookies
- Building site maps, discovering content, and identifying hidden endpoints
- Reviewing API and JSON traffic patterns
Verifying Security Configurations and Transport Controls
- Reviewing header, cookie, and CORS configurations
- Examining TLS settings, HTTP methods, and error disclosure practices
- Benchmarking against agreed-upon configuration baselines
Testing Authentication Controls
- Evaluating login, MFA, and credential policy behaviors
- Inspecting session tokens, fixation risks, and logout handling
- Identifying token and JWT validation weaknesses
Testing Authorization and Access Controls
- Testing horizontal and vertical privilege escalation across roles
- Detecting insecure direct object references and forced browsing issues
- Documenting role matrix evidence and comparative analysis
Injection, Input Processing, and Out-of-Band Verification
- Confirming injection vulnerabilities without using destructive payloads
- Testing cross-site scripting and client-side sinks
- Handling blind and out-of-band cases using Collaborator
Business Logic and Workflow Examination
- Assessing multi-step workflows and sequence enforcement
- Testing for parameter tampering in price, quantity, and approval fields
- Evaluating replay attacks, race conditions, and repeat-action abuses
Scanner-Supported Coverage, Extensions, and AI Assistance
- Configuring crawl and audit settings for scoped coverage
- Triaging issues and validating false positives
- Creating custom checks with BChecks and extensions
- Utilizing Burp AI and agentic testing while respecting data handling limits
Evidence Gathering and Audit Reporting
- Capturing request and response evidence with accurate timestamps
- Redacting sensitive data and managing evidence integrity
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE standards
- Assigning risk ratings using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a training application
- Preparing workpapers, the findings register, and a closing debrief
Requirements
- Practical experience in IT auditing and IT security assessments
- Working understanding of technology risk, security controls, and network protocols
- Knowledge of HTTP/HTTPS and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (1)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
